Cyber Resilience

CVE-2026-8337

Access Control in Concretecms Concrete Cms ≤ 9.5.1

Access Control
Published
21 May 2026
Modified
23 July 2026
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0019 9th percentile
Risk Priority 38 floored blend · peak EPSS

Summary

CVE-2026-8337 is a medium-severity Reliance on Cookies without Validation and Integrity Checking (CWE-565) vulnerability in Concretecms Concrete Cms. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability Data

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can…

more

vote in the restricted survey by submitting the restricted optionID through the public survey’s endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Zer0daySec https://github.com/Zee99y for reporting

CWE(s)
CWE-565CWE-639

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-8204Same product: Concretecms Concrete Cms
CVE-2026-7881Same product: Concretecms Concrete Cms
CVE-2026-8347Same product: Concretecms Concrete Cms
CVE-2026-7886Same product: Concretecms Concrete Cms
CVE-2023-28474Same product: Concretecms Concrete Cms
CVE-2024-3179Same product: Concretecms Concrete Cms
CVE-2024-3180Same product: Concretecms Concrete Cms
CVE-2025-3153Same product: Concretecms Concrete Cms
CVE-2026-8197Same product: Concretecms Concrete Cms
CVE-2024-7394Same product: Concretecms Concrete Cms

Affected Assets

concretecms
concrete cms
≤ 9.5.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.

AC-24 Access Control Decisions good match

Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.

SC-23 Session Authenticity good match

Session Authenticity directly requires protecting the integrity and authenticity of session tokens such as cookies, eliminating blind reliance on them.

AC-6 Least Privilege partial match

Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.

SC-8 Transmission Confidentiality and Integrity partial match

Transmission Confidentiality and Integrity mandates cryptographic or equivalent protection for data in transit, which covers cookie values exchanged over HTTP.

SI-7 Software, Firmware, and Information Integrity partial match

Software, Firmware, and Information Integrity can detect unauthorized modification of cookie-based data after the fact via integrity verification.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.DS-02 mostly match
prevents

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

PR.DS-01 partial match
prevents

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect cookie-validation flaws but does not itself implement the required controls.

A.8.3 Information access restriction mostly match
prevents

Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.

A.5.15 Access control partial match
prevents

Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.

A.5.18 Access rights partial match
prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

A.8.2 Privileged access rights partial match
mitigates

Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes authorization design but does not itself implement runtime access checks.

References